.avif)
.webp)
.png)
Introduction
Small Business Innovation Research (SBIR) companies often work on cutting-edge projects funded by the U.S. Department of Defense (DoD). With these opportunities comes the responsibility to safeguard Controlled Unclassified Information (CUI), especially for Phase II companies. To understand these cybersecurity expectations, it helps to know the experts shaping this guidance.
Kelly Kiernan has historically been the point of contact within the DoD SBIR program. She's held Chief Technology Officer roles for the Air Force, Space Force, and now the U.S. Navy Small Business Innovation Research (SBIR) and Technology Transfer (STTR) programs and founded the DoD’s Blue Cyber Initiative—a support program offering office hours, weekly webinars, and technical resources to help the thousands of DoD SBIR/STTR firms with the cybersecurity requirements in their contracts.
She now is a professor of Cybersecurity at the DoD’s Defense Acquisition University (DAU), where she trains contracting officers, program managers, engineers, and others within the government on how NIST SP 800‑171, CMMC, and DFARS/FAR cybersecurity clauses apply to federal contracts.
CUI in Phase 1 vs. Phase 2
"I've never seen a Phase II SBIR that is not generating CTI".
- Kelly Kiernan
SBIR awards evolve in scope and security. While Phase I contracts may or may not involve Controlled Unclassified Information (CUI), Phase II projects almost always generate and handle sensitive technical data. As a result, Phase II awardees must fully implement the rigorous—and often costly—cyber requirements of DFARS 252.204-7012 and NIST SP 800-171. These requirements are not only extensive but also expensive, as even small SBIR companies need a qualified cybersecurity professional to implement them correctly. As the guidance from Kelley states, “Whoever is doing your cyber needs to be a professional.” She further notes that qualified cybersecurity professionals “cost at least $100,000,” stated in her “It Might Be CUI If…” webinar. Because much of the CUI SBIR companies handle is self-generated, Kelley points out that these businesses also have a “vested self-interest” in protecting their own information for cybersecurity purposes—not just the government’s.
As she emphasizes in her DAU webinars, “I’ve never seen a Phase II SBIR that is not generating CTI,” referring to Controlled Technical Information, a common form of CUI. She also warns that even if CMMC requirements are not yet formally in place for your current phase, “they may implement them ahead of the scheduled phase—and they probably will.”
Defining CUI
In the DAU webinars “Protecting DoD Scientific and Technical Information (STI)” and “It Might Be CUI If…”, Kelley Kiernan, and Jodi St. Pierre, the program manager at Air Force Material Command (AFMC) who is responsible for implementing and administering the Scientific and Technical Information (STINFO) Program, provide guidance on the types of Controlled Unclassified Information SBIR companies may encounter. They emphasize that CUI includes any government-created or contractor-held information requiring protection under federal law, regulation, or policy:
Export-controlled research: Technical information about commodities, technologies, or software whose export could affect national security. As Kelley guides, this type of CUI is “regulated under the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR), which place strict limits on the release of sensitive technical data to foreign persons or entities, even within the U.S.”
Controlled Technical Information (CTI): Technical information with military or space applications subject to DoD controls. This is the most common category SBIR companies generate. Kelley shares insight into the types of CTI in her Blue Cyber Series video titled “Protection of Common Types of Department of Defense Controlled Unclassified Information”:
.webp){kind=icon}
.avif)
